Panorama Legacy to Panorama mode Log Migration

BaudMatt — Tue, 23 Aug 2022 00:30:26 GMT

I just completed moving a Panorama VM from Legacy mode to Panorama mode. Panorama is running 9.1.14-h4.

What I'm concerned about are the existing logs. From a document I read, you needed to run the following command

request logdb migrate vm start

then run

request logdb migrate vm status

to check the status. When it's done it should show "migration has been done"

The problem is, the migration showed no logs actually being migrated! Here's the output:

<username>@panorama-01> request logdb migrate vm status

migration has been done

'traffic' is done. 0 records migrated.
'config' is done. 0 records migrated.
'system' is done. 0 records migrated.
'threat' is done. 0 records migrated.
'appstat' is done. 0 records migrated.
'event' is done. 0 records migrated.
'alarm' is done. 0 records migrated.
'hipmatch' is done. 0 records migrated.
'userid' is done. 0 records migrated.
'iptag' is done. 0 records migrated.
'mdm' is done. 0 records migrated.
'extpcap' is done. 0 records migrated.
'gtp' is done. 0 records migrated.
'auth' is done. 0 records migrated.
'sctp' is done. 0 records migrated.
'globalprotect' is done. 0 records migrated.

When I go to the 'Monitor' tab and do a search by date nothing comes up (here's a search example: ( time_generated leq '2022/08/21 13:20:19' ) ). If I just start scrolling through the pages of the logs I do finally get to logs that existed before the migration was performed.

So:

1. Were the logs automatically migrated / moved to the new log location (the 2TB datastore)?

2. Does Panorama need time to re-index after the migration from Legacy to Panorama mode or the search bar parameters to work properly?

Thanks in advance.

Re: Panorama Legacy to Panorama mode Log Migration

BaudMatt — Thu, 25 Aug 2022 22:17:04 GMT

Yep. Did that and the Managed Collector shows "in sync" and "last commit succeeded." It honestly looks healthy.

My issue is that when I logdb migration it showed nothing being migrated and this seems wrong.

I just did another search for older logs but found it only showed 3 days worth.

From the cli command 'show log-collector serial-number' that detailed storage and summary storage are limited to 3 days and I'm not sure where to change this.

topic Re: Panorama Legacy to Panorama mode Log Migration in General Topics

Panorama Legacy to Panorama mode Log Migration

Re: Panorama Legacy to Panorama mode Log Migration